Test upper bound of certificates_issued

src/main/kotlin/Extension.kt

@@ -102,7 +102,7 @@ data class ProvisioningInfoMap(
 ) {
   fun cborEncode(): ByteArray {
     val map = CborModelMap()
-    map.put(UnsignedInteger(1L), certificatesIssued.asDataItem())
+    map.put(UnsignedInteger(CERTIFICATES_ISSUED_TAG), certificatesIssued.asDataItem())
     return cborEncode(map)
   }
 
@@ -113,6 +113,7 @@ data class ProvisioningInfoMap(
      * https://developer.android.com/privacy-and-security/security-key-attestation#provisioning_attestation_ext_schema
      */
     @JvmField val OID = ASN1ObjectIdentifier("1.3.6.1.4.1.11129.2.1.30")
+    internal const val CERTIFICATES_ISSUED_TAG = 1L
 
     @JvmStatic
     @JvmOverloads
@@ -132,7 +133,7 @@ data class ProvisioningInfoMap(
     private fun from(seq: CborModelMap): ProvisioningInfoMap {
       require(seq.keys.size >= 1)
       return ProvisioningInfoMap(
-        certificatesIssued = seq.get(UnsignedInteger(1L)).asInteger(),
+        certificatesIssued = seq.get(UnsignedInteger(CERTIFICATES_ISSUED_TAG)).asInteger(),
       )
     }
   }

src/main/kotlin/testing/Certs.kt

@@ -16,6 +16,7 @@
 
 package com.android.keyattestation.verifier.testing
 
+import co.nstant.`in`.cbor.CborBuilder
 import com.android.keyattestation.verifier.AttestationPackageInfo
 import com.android.keyattestation.verifier.AuthorizationList
 import com.android.keyattestation.verifier.KeyDescription
@@ -25,6 +26,7 @@ import com.android.keyattestation.verifier.ProvisioningInfoMap
 import com.android.keyattestation.verifier.RootOfTrust
 import com.android.keyattestation.verifier.SecurityLevel
 import com.android.keyattestation.verifier.VerifiedBootState
+import com.android.keyattestation.verifier.cborEncode
 import com.android.keyattestation.verifier.provider.KeyAttestationCertPath
 import com.google.protobuf.ByteString
 import com.google.protobuf.kotlin.toByteStringUtf8
@@ -406,6 +408,58 @@ object CertLists {
     )
   }
 
+  val maxCertificatesIssued by lazy {
+    val rkpAttestationCert =
+      certFactory.generateRkpAttestationCert(
+        securityLevel = SecurityLevel.TRUSTED_ENVIRONMENT,
+        serialNumber = TEST_ATTESTATION_SERIAL_NUMBER,
+        extraExtension =
+          Extension(
+            ProvisioningInfoMap.OID,
+            /* critical= */ false,
+            ProvisioningInfoMap(
+                certificatesIssued = Int.MAX_VALUE,
+              )
+              .cborEncode(),
+          ),
+      )
+    listOf(
+      certFactory.generateLeafCert(issuer = rkpAttestationCert.subject),
+      rkpAttestationCert,
+      certFactory.rkpIntermediate,
+      Certs.remoteIntermediate,
+      certFactory.root,
+    )
+  }
+
+  val outOfBoundsCertificatesIssued by lazy {
+    val rkpAttestationCert =
+      certFactory.generateRkpAttestationCert(
+        securityLevel = SecurityLevel.TRUSTED_ENVIRONMENT,
+        serialNumber = TEST_ATTESTATION_SERIAL_NUMBER,
+        extraExtension =
+          Extension(
+            ProvisioningInfoMap.OID,
+            /* critical= */ false,
+            cborEncode(
+              CborBuilder()
+                .addMap()
+                .put(ProvisioningInfoMap.CERTIFICATES_ISSUED_TAG, Int.MAX_VALUE.toLong() + 1)
+                .end()
+                .build()
+                .single()
+            ),
+          ),
+      )
+    listOf(
+      certFactory.generateLeafCert(issuer = rkpAttestationCert.subject),
+      rkpAttestationCert,
+      certFactory.rkpIntermediate,
+      Certs.remoteIntermediate,
+      certFactory.root,
+    )
+  }
+
   /* Different revoked serial numbers for testing. */
   @JvmField val REVOKED_SERIAL_NUMBER = 42.toBigInteger()
   @JvmField val REVOKED_SERIAL_NUMBER_BIG = 8000000000000.toBigInteger()
@@ -471,6 +525,14 @@ object Chains {
     KeyAttestationCertPath(CertLists.validRemotelyProvisioned)
   }
 
+  @JvmStatic
+  val maxCertificatesIssued by lazy { KeyAttestationCertPath(CertLists.maxCertificatesIssued) }
+
+  @JvmStatic
+  val outOfBoundsCertificatesIssued by lazy {
+    KeyAttestationCertPath(CertLists.outOfBoundsCertificatesIssued)
+  }
+
   @JvmStatic val wrongTrustAnchor by lazy { KeyAttestationCertPath(CertLists.wrongTrustAnchor) }
 
   /* A chain where the intermediate certificate has a mismatched subject. */

src/main/kotlin/testing/KeyAttestationCertFactory.kt

@@ -123,6 +123,15 @@ internal class KeyAttestationCertFactory(
     serialNumber: BigInteger,
     notBefore: Date = fakeCalendar.lastWeek(),
     notAfter: Date = fakeCalendar.nextWeek(),
+    extraExtension: Extension =
+      Extension(
+        ProvisioningInfoMap.OID,
+        /* critical= */ false,
+        ProvisioningInfoMap(
+            certificatesIssued = 1,
+          )
+          .cborEncode(),
+      ),
   ) =
     generateAttestationCert(
       signingKey = rkpKey.private,
@@ -131,15 +140,7 @@ internal class KeyAttestationCertFactory(
       serialNumber,
       notBefore,
       notAfter,
-      extraExtension =
-        Extension(
-          ProvisioningInfoMap.OID,
-          /* critical= */ false,
-          ProvisioningInfoMap(
-              certificatesIssued = 1,
-            )
-            .cborEncode(),
-        ),
+      extraExtension = extraExtension,
     )
 
   internal fun generateAttestationCert(

src/test/kotlin/ExtensionTest.kt

@@ -67,6 +67,27 @@ class ExtensionTest {
     assertThat(provisioningInfo).isEqualTo(expectedProvisioningInfo)
   }
 
+  @Test
+  fun parseFrom_maxCertificatesIssuedFromAttestationCert_success() {
+    val expectedProvisioningInfo =
+      ProvisioningInfoMap(
+        certificatesIssued = Int.MAX_VALUE,
+      )
+    val provisioningInfo =
+      ProvisioningInfoMap.parseFrom(Chains.maxCertificatesIssued.attestationCert(), InputLimits())
+    assertThat(provisioningInfo).isEqualTo(expectedProvisioningInfo)
+  }
+
+  @Test
+  fun parseFrom_outOfBoundsCertificatesIssuedFromAttestationCert_throws() {
+    assertThrows(IllegalArgumentException::class.java) {
+      ProvisioningInfoMap.parseFrom(
+        Chains.outOfBoundsCertificatesIssued.attestationCert(),
+        InputLimits(),
+      )
+    }
+  }
+
   @Test
   @TestParameters(valuesProvider = TestCaseProvider::class)
   fun parseFrom_success(model: String, sdk: Int) {

src/test/kotlin/VerifierTest.kt

@@ -371,6 +371,20 @@ class VerifierTest {
     assertIs<VerificationResult.Success>(verifier.verify(CertLists.validRemotelyProvisioned))
   }
 
+  @Test
+  fun verify_maxCertificatesIssued_succeedsWithMaxDeviceInformation() {
+    val result =
+      assertIs<VerificationResult.Success>(verifier.verify(CertLists.maxCertificatesIssued))
+    assertThat(result.deviceInformation?.certificatesIssued).isEqualTo(Int.MAX_VALUE)
+  }
+
+  @Test
+  fun verify_outOfBoundsCertificatesIssued_succeedsWithNullDeviceInformation() {
+    val result =
+      assertIs<VerificationResult.Success>(verifier.verify(CertLists.outOfBoundsCertificatesIssued))
+    assertThat(result.deviceInformation).isNull()
+  }
+
   @Test
   fun importedOrigins_customConfig_succeeds() {
     val verifier =